Data from deleted users can be reused when creating a new use with the same callsign-SSID (1.0.9)

[n9jr]

Discovered when testing user creation with different node authentication policies. When creating N9JR-14 (again) with the policy of require MFA for users. It sent a OTP to the email of the previously deleted user which it shouldn't.

pi@zero:~ $ telnet dxcluster 7300
Trying 192.168.222.19...
Connected to dxcluster.
Escape character is '^]'.
login: n9jr-14
otp: 178218

[AI3I]

Fixed locally: delete_user_account now clears registration_requests and MFA challenges as part of removing a user account, so recreating the same callsign/SSID cannot inherit old request/email/challenge state. Added store-level regression coverage for stale registration request and MFA challenge cleanup.

[AI3I]

Committed in 3907f4e. delete_user_account now clears stale registration_requests and MFA challenges in addition to registry/user data, so a reused callsign-SSID does not inherit deleted/denied-user state. Covered by tests/test_store.py::test_delete_user_account_removes_registry_and_all_user_data and deployed-host targeted tests.

[n9jr]

Or it pulls the email from another account. This was a fresh install and N9JR-13 had not been used before. With enable MFA and require MFA for user logins it did not go through the registration interview but instead sent an OTP email.

pi@intrepid:~ $ telnet dxcluster 7300
Trying 192.168.222.19...
Connected to dxcluster.
Escape character is '^]'.
login: n9jr-13
otp: